[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <CALCETrWRW665iFtiJqt2heb4cBwa7JwmNp03H90jiA=6JPsAdA@mail.gmail.com>
Date: Thu, 18 Dec 2014 11:35:01 -0800
From: Andy Lutomirski <luto@...capital.net>
To: oss-security@...ts.openwall.com
Subject: CVE Request: Linux x86_64 userspace address leak
On all* Linux x86_64 kernels, malicious user programs can learn the
TLS base addresses of threads** that they preempt.
In principle, this bug will allow programs to partially bypass ASLR
when attacking other user programs. Figuring out how to adapt the
test code to do that is left as an exercise to the reader.
The bug is fixed here:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/arch/x86?id=f647d7c155f069c1a068030255c300663516420e
There's a test case in the patch description.
Note: the patch description mentions another unfixed but and has a
test for that bug as well. As far as I can tell, the other bug has no
security implications -- it merely allows a program to cause the
kernel to replace its segment bases with predictable values during the
next context switch.
* It's possible that I missed something and this bug was introduced
more recently.
** The attack won't work against 64-bit threads with TLS bases > 4GB,
but AFAIK that's unusual. It also won't work against the small number
of programs using obsolete threading libraries that point their TLS
segments into the LDT.
--Andy
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
